January 2023 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2023:0026-1: moderate: Recommended update for chromium
by maintenance＠opensuse.org 21 Jan '23

21 Jan '23

openSUSE Recommended Update: Recommended update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0026-1 Rating: moderate References: #1207147 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for chromium fixes the following issues: * ensure TextCodecCJK doesn't conflict with system icu (boo#1207147) * align default characters for old icu with that of ICU 72 * make V8 aware of space in ICU 72 time format Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-26=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-109.0.5414.74-bp154.2.61.1 chromium-109.0.5414.74-bp154.2.61.1 References: https://bugzilla.suse.com/1207147

1 0

openSUSE-SU-2023:0027-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 21 Jan '23

21 Jan '23

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0027-1 Rating: moderate References: #1207110 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for tor fixes the following issues: tor 0.4.7.13: * fix SafeSocks option to avoid DNS leaks (boo#1207110, TROVE-2022-002) * improve congestion control * fix relay channel handling tor 0.4.7.12: * new key for moria1 * new metrics are exported on the MetricsPort for the congestion control subsystem Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-27=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): tor-0.4.7.13-bp154.2.12.1 References: https://bugzilla.suse.com/1207110

1 0

openSUSE-SU-2023:0025-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 21 Jan '23

21 Jan '23

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0025-1 Rating: important References: #1206185 Cross-References: CVE-2022-46169 CVSS scores: CVE-2022-46169 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-46169 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.23: * Fix unexpected reindexing when using uptime as the reindex method * Spine should prevent the script server from connecting to remote when offline * Improve Script Server Timeout Logging * Add SQL_NO_CACHE to Spine Queries cacti 1.2.23, providing security fixes, feature improvements and bug fixes: * CVE-2022-46169: Unauthenticated Command Injection in Remote Agent (boo#1206185) * Security: Add .htaccess file to scripts folder * When using Single Sign-on Frameworks, revocation was not always detected in callbacks * Fixes to the installer, and compatibility with PHP and MySQL * Performance improvements for certain conditions * Various UI fixes * Bug fixes related to SNMP, RRDtools, and agents Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2023-25=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.23-26.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.23-32.1 References: https://www.suse.com/security/cve/CVE-2022-46169.html https://bugzilla.suse.com/1206185

1 0

openSUSE-RU-2023:0024-1: moderate: Recommended update for php-redis
by maintenance＠opensuse.org 20 Jan '23

20 Jan '23

openSUSE Recommended Update: Recommended update for php-redis ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0024-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for php-redis fixes the following issues: Updated to 5.3.7 * https://pecl.php.net/package-changelog.php?package=redis&release=5.3.7 * Fixed RedisArray::[hsz]scan and tests. * Fixed RedisArray::scan. * Fixed LZF decompression logic. - Updated to 5.3.6 * Fix a segfault in RedisArray::del - Updated to 5.3.5 * https://pecl.php.net/package-changelog.php?package=redis&release=5.3.5 * Added experimental support for detecting a dirty connection. * Fixed RedisArray constructor bug. * Fixed segfault in redis_setoption_handler. * Fixed masters array in the event of a cluster failover. * Fixed 32 bit type error. * Fixed radix character in certain locales. * Fixed ZSTD Validation. - Update to 5.3.4 * Fix multi/pipeline segfault on Apple silicon * Pass compression flag on HMGET in RedisCluster * Abide by ZSTD error return constants * Fix timing related CI session tests - Update to 5.3.3 * Fix PHP8 Windows includes * Fix hash ops for php 8.0.1 * Disable cloning Redis and RedisCluster objects - Update to 5.3.2 * Use "%.17g" sprintf format for doubles as done in Redis server. * Allow to pass NULL as RedisCluster stream context options. * Verify SET options are strings before testing them as strings * Fix cluster segfault when dealing with NULL multi bulk replies in RedisCluster * Fix xReadGroup() must return message id * Fix memory leak in rediscluster session handler * Fix XInfo() returns false if the stream is empty * Relax requirements on set's expire argument * Refactor redis_sock_check_liveness * PHP8 compatibility * Update documentation * Add Redis::OPT_NULL_MULTIBULK_AS_NULL setting to treat NULL multi bulk replies as NULL instead of []. * Allow to specify stream context for rediscluster session handler * Add new parameter to RedisCluster to specify stream ssl/tls context. * Add new parameter to RedisSentinel to specify auth information - Update to 5.3.1 * https://pecl.php.net/package-changelog.php?package=redis&release=5.3.1 * Properly clean up on session start failure. * Treat NULL as a failure for redis_extract_auth_info. * Don't dereference a NULL zend_string or efree one. * Fix config.m4 messages and test for and include php_hash.h. - Update to 5.3.0 * https://pecl.php.net/package-changelog.php?package=redis&release=5.3.0 * Support for Redis 6 ACLs. * LZ4 Compression. * Support for new Redis 6 arguments. * Support for TLS connections. * New option Redis::SCAN_PREFIX, Redis::SCAN_NOPREFIX. * Configurable unit test authentication arguments. * Improved cluster slot caching mechanism to fix a couple of bugs and make it more efficient. * Stop calling Redis constructor when creating a RedisArray. * Use ZEND_LONG_FMT instead of system `long`. * Use long for SCAN iteration to fix potential overflow. * Avoid use-after-free of RediSock. * Use the portable `ZEND_LONG_FORMAT` family instead of C format specifiers. * PHP 8 compatibility. - Update to 5.2.2 * https://pecl.php.net/package-changelog.php?package=redis&release=5.2.2 This is a bugfix release that contains a fix for authentication when using persistent connections, and an option to make the ECHO challenge response logic optional. * Inexpensive liveness check, and making ECHO optional [56898f81] (Pavlo Yatsukhnenko) * Move `AUTH` to `redis_sock_server_open` [80f2529b](Pavlo Yatsukhnenko) - Update to 5.2.1 * https://pecl.php.net/package-changelog.php?package=redis&release=5.2.1 * Fix arginfo for Redis::zadd. * Fix segfault on closing persistent stream. - Update to 5.2.0 * https://pecl.php.net/package-changelog.php?package=redis&release=5.2.0 * Include RedisSentinelTest.php in package.xml! * Fix -Wmaybe-uninitialized warning. * Fix improper destructor when zipping values and scores. * Use php_rand instead of php_mt_rand for liveness challenge string. * Initial support for RedisSentinel. * Fix for ASK redirections. * Create specific 'test skipped' exception. * Fixed memory leaks in RedisCluster. * Fixes for session lifetime values that underflow or overflow. * Enables slot caching for Redis Cluster. * Support TYPE argument for SCAN. * Added challenge/response mechanism for persistent connections. - Update to 5.1.1 * https://pecl.php.net/package-changelog.php?package=redis&release=5.1.1 * Fix fail to connect to redis through unix socket. * Documentation improvements. - Update to 5.1.0 * https://pecl.php.net/package-changelog.php?package=redis&release=5.1.0 * Fix regression for multihost_distribute_call added in 112c77e3. * Fix regression for conntecting to unix sockets with relative path added in 1f41da64. * Fix unix-socket detection logic broken in 418428fa. * Fix memory leak and bug with getLastError for redis_mbulk_reply_assoc and redis_mbulk_reply_zipped. * Fix bug with password contain "#" for redis_session. * Add optional support for Zstd compression, using --enable-redis-ztsd. This requires libzstd version >= 1.3.0. * Fix overallocation in RedisCluster directed node commands. * Also attach slaves when caching cluster slots. * Use zend_register_persistent_resource_ex for connection pooling. * Refactor redis_session. * Documentation improvements. * Fix missing null byte in PHP_MINFO_FUNCTION. * Remove dead code generic_unsubscribe_cmd. * Add documentation for zpopmin and zpopmax. * Allow to specify scheme for session handler. - Refresh spec-file with manual optmizations * Remove version limit from BuildRequires:php7-devel (no actual). * Remove BuildRequires:php7-soap (no needed). * Add BuildRequires:php7-json (need for tests, but still does not load). * Add %make_build and %make_install macros. - Update to 5.0.2 * https://pecl.php.net/package-changelog.php?package=redis&release=5.0.2 * RedisCluster segfaults after second connection with cache_slots enabled. * Cleanup TSRMLS_* usage. * Replace ulong with zend_ulong. * Replace uint with uint32_t. * Fix regression for conntecting to ports > 32767. * RedisCluster segfaults after second connection with cache_slots enabled. * Documentation improvements. - Update to 5.0.0 This release contains important improvements and breaking changes. The most interesting are: drop PHP5 support, RedisCluster slots caching, JSON and msgpack serializers, soft deprecation of non-Redis commands. * Remove HAVE_SPL * Allow compilation without JSON serialization enabled and fixes for deprecated helper methods. * Enable connection pooling by default * Soft deprecate methods that aren't actually Redis commands * Enable pooling for cluster slave nodes * xInfo response format * Make the XREADGROUP optional COUNT and BLOCK arguments nullable * Allow PING to take an optional argument * Allow ZRANGE to be called either with `true` or `['withscores' => true]` * Allow to specify server address as schema://host * Allow persistent_id to be passed as NULL with strict_types enabled * Add server address to exception message * Adds OPT_REPLY_LITERAL for rawCommand and EVAL * JSON serializer * Add support for STREAM to the type command * Fix TypeError when using built-in constants in `setOption` * Handle references in MGET * msgpack serializer * Add Cluster slots caching * Drop PHP5 support * Documentation improvements - Update to 4.3.0 * Proper persistent connections pooling implementation * RedisArray auth * Use zend_string for storing key * Add ZPOPMAX and ZPOPMIN support * Implement GEORADIUS_RO and GEORADIUSBYMEMBER_RO * Add callback parameter to subscribe/psubscribe arginfo * Don't check the number affected keys in PS_UPDATE_TIMESTAMP_FUNC * Xgroup updates * RedisCluster auth * Cancel pipeline mode without executing commands * Use zend_string for pipeline_cmd * Different key hashing algorithms from hash extension * Breaking the lock acquire loop in case of network problems * Implement consistent hashing algorithm for RedisArray * Use zend_string for storing RedisArray hosts * Update lzf_compress to be compatible with PECL lzf extension * Fix RedisCluster keys memory leak * Directly use return_value in RedisCluster::keys method * Fix segfault in Redis Cluster with inconsistent configuration * Masters info leakfix * Refactor redis_sock_read_bulk_reply * Remove unused parameter lazy_connect from redis_sock_create * Remove useless ZEND_ACC_[C|D]TOR. * Documentation improvements - Added additional settings to redis.ini - Update to 4.2.0 * https://pecl.php.net/package-changelog.php?package=redis&release=4.2.0 * Optimize close method. * Prevent potential infinite loop for sessions. * Fix coverty warnings. * Fix session memory leaks. * Fix XCLAIM on 32-bit installs. * Build warning fixes. * Fix incorrect arginfo for `Redis::sRem` and `Redis::multi`. * Update STREAM API to handle STATUS -> BULK reply change. * Treat a -1 response from cluster_check_response as a timeout. * Use a ZSET insted of SET for EVAL tests. * Missing space between command and args. * Streams API. * Reset the socket after a timeout to make sure no wrong data is received. * Modify session testing logic. * Allow '-' and '+' arguments and add tests for zLexCount and zRemRangeByLex. * Fix printf format warnings. * Session module is required. * Set default values for ini entries. * Display ini entries in output of phpinfo. * Persistant connections can be closed via close method + change reconnection logic. * Documentation improvements. - Update to 4.1.1 * https://pecl.php.net/package-changelog.php?package=redis&release=4.1.1 * Fix arginfo for Redis::set method. * Fix compression in RedisCluster. * Fix TravisCI builds. * Highlight php codes in documentation. - Update to 4.1.0 * https://pecl.php.net/package-changelog.php?package=redis&release=4.1.0 * Add callbacks validate_sid and update_timestamp to session handler. * Call cluster_disconnect before destroying cluster object. * Bulk strings can be zero length. * Handle async parameter for flushDb and flushAll. * Split INSTALL and add more instructions. * Only the first arg of connect and pconnect is required. * Add session locking functionality. * Fix compression in RedisCluster. * Refactor geo* commands + documentation improvements. - Update to 4.0.2 * https://pecl.php.net/package-changelog.php?package=redis&release=4.0.2 * Fix of exists method to take multiple keys and return integer value. - Update to 4.0.1 * Fix arginfo for connect/pconnect issue * Don't leak a ZVAL * Fix config.m4 for lzf * Updates EXISTS documentation and notes change in 4.0.0 * Fix typo in notes - Update to 4.0.0 * https://pecl.php.net/package-changelog.php?package=redis&release=4.0.0 * Add proper ARGINFO for all methods. * Let EXISTS take multiple keys. * Use zend_string as returning value for ra_extract_key and ra_call_extractor. * Implement SWAPDB and UNLINK commands. * Return real connection error as exception. * Disallow using empty string as session name. * Use zend_string for storing auth and prefix members. * The element of z_seeds may be a reference on php7. * Avoid connection in helper methods. * Add tcp_keepalive option to redis sock. * More robust GEORADIUS COUNT validation. * Add LZF compression (experimental). * Allow to use empty string as persistant_id. * Don't use convert_to_string in redis_hmget_cmd. * Allow mixing MULTI and PIPELINE modes (experimental). * PHP >=7.3.0 uses zend_string to store `php_url` elements. * Documentation improvements. - Remove %configure/make duplicates. - Add %licence macros. - Build with hidden visibility, only a few symbols must be exported, those are marked with default visibility in PHP core headers. - Update to 3.1.6 * ChangeLog https://pecl.php.net/package-changelog.php?package=redis&release=3.1.6 * Fix of RedisArray distributor hashing function which was broken in 3.1.4. * Fix RedisCluster constructor with PHP 7 strict scalar type. * Allow to use empty string as persistant_id. * Fix cluster_init_seeds. * Fix z_seeds may be a reference. * PHP >=7.3 uses zend_string for php_url elements. - Update to 3.1.4 * ChangeLog https://pecl.php.net/package-changelog.php?package=redis&release=3.1.4 * Allow mixing MULTI and PIPELINE modes (experimental). * Added integration for coverty static analysis and fixed several warnings. * Fixed link to redis cluster documentation. * Remove unused PHP_RINIT and PHP_RSHUTDOWN functions. * Removed duplicate HGET in redis array hash table, formatting. * Treat NULL bulk as success for session read. * Refactor redis_send_discard. * Updated runtime exception handling. * Added a github issue template. * Initialize gc member of zend_string. * Fix valgrind warnings. * Fix php5/php7 compatibility layer. * Fix typo in README.markdown. * Improve redis array rehash. * Change redis array pure_cmds from zval to hashtable. * Don't try to set TCP_NODELAY on a unix socket and don't warn on multiple calls to pipeline. * Use zend_string rather than char* for various context fields. * Various other library fixes. - Remove the php5 packages as the php5 language is being removed - Update to 3.1.3 * ChangeLog https://pecl.php.net/package-changelog.php?package=redis&release=3.1.3 - Add config file redis.ini - Format spec-file to macro style - Upgraded to version 3.1.2 * RedisArray segfault fix [564ce3] (Pavlo Yatsukhnenko) * Small memory leak fix [645888b] (Mike Grunder) * Segfault fix when recreating RedisCluster objects [abf7d4] (Michael Grunder) * Fix for RedisCluster bulk response parsing [4121c4] (Alberto Fern?ndez) * Re allow single array for sInterStore [6ef0c2, d01966] (Michael Grunder) * Better TravisCI integration [4fd2f6] (Pavlo Yatsukhnenko) - Upgraded to version 3.1.1 This release contains mostly fixes for issues introduced when merging the php 5 and 7 codebase into a single branch. * Fixed a segfault in igbinary serialization (@yatsukhnenko) * Restore 2.2.8/3.0.0 functionality to distinguish between an error and simply empty session data. (@remicollet) * Fix double to string conversion function (@yatsukhnenko) * Use PHP_FE_END definition when available (@remicollet) * Fixed various 'static function declared but not used' warnings * Fixes to various calls which were typecasting pointers to the wrong size. (@remicollet) * Additional test updates for 32 bit systems (@remicollet) * ARM rounding issue in tests (@remicollet) * Use new zend_list_close instead of zend_list_delete when reconnecting. * Refactoring of redis_boolean_response_impl and redis_sock_write (@yatsukhnenko) * Added php session unit test (@yatsukhnenko) * Added explicit module dependancy for igbinary (@remicollet) * Added phpinfo serialization information (@remicollet) - Version 3.1.0 In this version of phpredis codebase was unified to work with all versions of php. Also many bug fixes and some improvements has been made. - Improvements * Support the client to Redis Cluster just having one master (andyli) [892e5646] * Allow both long and strings that are longs for zrangebyscore offset/limit (Michael Grunder) [bdcdd2aa] * Process NX|XX, CH and INCR options in zAdd command (Pavlo Yatsukhnenko) [71c9f7c8] - Fixes * Fix incrby/decrby for large integers (Michael Grunder) [3a12758a] * Use static declarations for spl_ce_RuntimeException decl (Jeremy Mikola) [a9857d69] * Fixed method call problem causes session handler to display two times (ZiHang Gao) [24f86c49] * psetex method returns '+OK' on success, not true (sitri@ndxbn) [afcd8445] * Fix integer overflow for long (>32bit) increments in hIncrBy (iyesin) [58e1d799] * Move zend_object handler to the end (Michael Grunder) [34107966] * Using setOption on redis array causes immediate connection (Pavlo Yatsukhnenko) [f1a85b38] - Provide php-redis as php5 and php7 can't be installed together Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-24=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): php7-redis-5.3.7-bp154.2.1 php8-redis-5.3.7-bp154.2.1 References:

1 0

SUSE-SU-2023:0114-1: important: Security update for sudo
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0114-1 Rating: important References: #1207082 Cross-References: CVE-2023-22809 CVSS scores: CVE-2023-22809 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sudo fixes the following issues: - CVE-2023-22809: Fixed an arbitrary file write issue that could be exploited by users with sudoedit permissions (bsc#1207082). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.3: zypper in -t patch openSUSE-Leap-Micro-5.3-2023-114=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-114=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-114=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2023-114=1 Package List: - openSUSE Leap Micro 5.3 (aarch64 x86_64): sudo-1.9.9-150400.4.12.1 sudo-debuginfo-1.9.9-150400.4.12.1 sudo-debugsource-1.9.9-150400.4.12.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): sudo-1.9.9-150400.4.12.1 sudo-debuginfo-1.9.9-150400.4.12.1 sudo-debugsource-1.9.9-150400.4.12.1 sudo-devel-1.9.9-150400.4.12.1 sudo-plugin-python-1.9.9-150400.4.12.1 sudo-plugin-python-debuginfo-1.9.9-150400.4.12.1 sudo-test-1.9.9-150400.4.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): sudo-1.9.9-150400.4.12.1 sudo-debuginfo-1.9.9-150400.4.12.1 sudo-debugsource-1.9.9-150400.4.12.1 sudo-devel-1.9.9-150400.4.12.1 sudo-plugin-python-1.9.9-150400.4.12.1 sudo-plugin-python-debuginfo-1.9.9-150400.4.12.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): sudo-1.9.9-150400.4.12.1 sudo-debuginfo-1.9.9-150400.4.12.1 sudo-debugsource-1.9.9-150400.4.12.1 References: https://www.suse.com/security/cve/CVE-2023-22809.html https://bugzilla.suse.com/1207082

1 0

SUSE-SU-2023:0108-1: important: Security update for git
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0108-1 Rating: important References: #1207032 #1207033 Cross-References: CVE-2022-23521 CVE-2022-41903 CVSS scores: CVE-2022-23521 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-41903 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git fixes the following issues: - CVE-2022-41903: Fixed a heap overflow in the "git archive" and "git log --format" commands (bsc#1207033). - CVE-2022-23521: Fixed an integer overflow that could be triggered when parsing a gitattributes file (bsc#1207032). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-108=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-108=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-108=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-108=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-108=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-108=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-108=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2023-108=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2023-108=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): git-svn-debuginfo-2.26.2-150000.44.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): git-doc-2.26.2-150000.44.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Enterprise Storage 7 (noarch): git-doc-2.26.2-150000.44.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Enterprise Storage 6 (noarch): git-doc-2.26.2-150000.44.1 - SUSE CaaS Platform 4.0 (noarch): git-doc-2.26.2-150000.44.1 - SUSE CaaS Platform 4.0 (x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 References: https://www.suse.com/security/cve/CVE-2022-23521.html https://www.suse.com/security/cve/CVE-2022-41903.html https://bugzilla.suse.com/1207032 https://bugzilla.suse.com/1207033

1 0

SUSE-SU-2023:0110-1: important: Security update for git
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0110-1 Rating: important References: #1207032 #1207033 Cross-References: CVE-2022-23521 CVE-2022-41903 CVSS scores: CVE-2022-23521 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-41903 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Realtime Extension 15-SP3 SUSE Linux Enterprise Server 15-SP3-LTSS SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git fixes the following issues: - CVE-2022-41903: Fixed a heap overflow in the "git archive" and "git log --format" commands (bsc#1207033). - CVE-2022-23521: Fixed an integer overflow that could be triggered when parsing a gitattributes file (bsc#1207032). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-110=1 - SUSE Manager Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-110=1 - SUSE Manager Retail Branch Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-110=1 - SUSE Manager Proxy 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-110=1 - SUSE Linux Enterprise Server for SAP 15-SP3: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-110=1 - SUSE Linux Enterprise Server 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-110=1 - SUSE Linux Enterprise Realtime Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-110=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-110=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-110=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-110=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-110=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2023-110=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-credential-gnome-keyring-2.35.3-150300.10.21.1 git-credential-gnome-keyring-debuginfo-2.35.3-150300.10.21.1 git-credential-libsecret-2.35.3-150300.10.21.1 git-credential-libsecret-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-p4-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - openSUSE Leap 15.4 (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Manager Server 4.2 (ppc64le s390x x86_64): git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Manager Retail Branch Server 4.2 (x86_64): git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Manager Proxy 4.2 (x86_64): git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (ppc64le x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (aarch64 x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (aarch64 x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Enterprise Storage 7.1 (noarch): git-doc-2.35.3-150300.10.21.1 References: https://www.suse.com/security/cve/CVE-2022-23521.html https://www.suse.com/security/cve/CVE-2022-41903.html https://bugzilla.suse.com/1207032 https://bugzilla.suse.com/1207033

1 0

SUSE-SU-2023:0115-1: important: Security update for sudo
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0115-1 Rating: important References: #1207082 Cross-References: CVE-2023-22809 CVSS scores: CVE-2023-22809 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Realtime Extension 15-SP3 SUSE Linux Enterprise Server 15-SP3-LTSS SUSE Linux Enterprise Server for SAP 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sudo fixes the following issues: - CVE-2023-22809: Fixed an arbitrary file write issue that could be exploited by users with sudoedit permissions (bsc#1207082). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2023-115=1 - SUSE Manager Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-115=1 - SUSE Manager Retail Branch Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-115=1 - SUSE Manager Proxy 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-115=1 - SUSE Linux Enterprise Server for SAP 15-SP3: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-115=1 - SUSE Linux Enterprise Server 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-115=1 - SUSE Linux Enterprise Realtime Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-115=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-115=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-115=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-115=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-115=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2023-115=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 - SUSE Manager Server 4.2 (ppc64le s390x x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Manager Retail Branch Server 4.2 (x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Manager Proxy 4.2 (x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (ppc64le x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le s390x x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (aarch64 x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (aarch64 x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 References: https://www.suse.com/security/cve/CVE-2023-22809.html https://bugzilla.suse.com/1207082

1 0

SUSE-SU-2023:0113-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0113-1 Rating: important References: #1207119 Cross-References: CVE-2022-46871 CVE-2022-46877 CVE-2023-23598 CVE-2023-23601 CVE-2023-23602 CVE-2023-23603 CVE-2023-23605 CVSS scores: CVE-2022-46871 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-46877 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Realtime Extension 15-SP3 SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3-LTSS SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Updated to version 102.7.0 ESR (bsc#1207119): - CVE-2022-46871: Updated an out of date library (libusrsctp) which contained several vulnerabilities. - CVE-2023-23598: Fixed an arbitrary file read from GTK drag and drop on Linux. - CVE-2023-23601: Fixed a potential spoofing attack when dragging a URL from a cross-origin iframe into the same tab. - CVE-2023-23602: Fixed a mishandled security check, which caused the Content Security Policy header to be ignored for WebSockets in WebWorkers. - CVE-2022-46877: Fixed a fullscreen notification bypass which could be leveraged in spoofing attacks. - CVE-2023-23603: Fixed a Content Security Policy bypass via format directives. - CVE-2023-23605: Fixed several memory safety bugs. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-113=1 - SUSE Linux Enterprise Server for SAP 15-SP3: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-113=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-113=1 - SUSE Linux Enterprise Server 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-113=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-113=1 - SUSE Linux Enterprise Realtime Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-113=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-113=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-113=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-113=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-113=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2023-113=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2023-113=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-branding-upstream-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (ppc64le x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le x86_64): MozillaFirefox-devel-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le x86_64): MozillaFirefox-devel-102.7.0-150200.152.73.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 References: https://www.suse.com/security/cve/CVE-2022-46871.html https://www.suse.com/security/cve/CVE-2022-46877.html https://www.suse.com/security/cve/CVE-2023-23598.html https://www.suse.com/security/cve/CVE-2023-23601.html https://www.suse.com/security/cve/CVE-2023-23602.html https://www.suse.com/security/cve/CVE-2023-23603.html https://www.suse.com/security/cve/CVE-2023-23605.html https://bugzilla.suse.com/1207119

1 0

SUSE-SU-2023:0119-1: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0119-1 Rating: important References: #1204272 #1207038 Cross-References: CVE-2022-23491 CVE-2022-3479 CVSS scores: CVE-2022-23491 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-23491 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-3479 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-3479 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mozilla-nss fixes the following issues: - CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but the client had no certificates stored (bsc#1204272). - Updated to version 3.79.3 (bsc#1207038): - CVE-2022-23491: Removed trust for 3 root certificates from TrustCor. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.3: zypper in -t patch openSUSE-Leap-Micro-5.3-2023-119=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-119=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-119=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2023-119=1 Package List: - openSUSE Leap Micro 5.3 (aarch64 x86_64): libfreebl3-3.79.3-150400.3.23.1 libfreebl3-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-3.79.3-150400.3.23.1 libsoftokn3-3.79.3-150400.3.23.1 libsoftokn3-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-3.79.3-150400.3.23.1 mozilla-nss-3.79.3-150400.3.23.1 mozilla-nss-certs-3.79.3-150400.3.23.1 mozilla-nss-certs-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debugsource-3.79.3-150400.3.23.1 mozilla-nss-tools-3.79.3-150400.3.23.1 mozilla-nss-tools-debuginfo-3.79.3-150400.3.23.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libfreebl3-3.79.3-150400.3.23.1 libfreebl3-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-3.79.3-150400.3.23.1 libsoftokn3-3.79.3-150400.3.23.1 libsoftokn3-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-3.79.3-150400.3.23.1 mozilla-nss-3.79.3-150400.3.23.1 mozilla-nss-certs-3.79.3-150400.3.23.1 mozilla-nss-certs-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debugsource-3.79.3-150400.3.23.1 mozilla-nss-devel-3.79.3-150400.3.23.1 mozilla-nss-sysinit-3.79.3-150400.3.23.1 mozilla-nss-sysinit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-tools-3.79.3-150400.3.23.1 mozilla-nss-tools-debuginfo-3.79.3-150400.3.23.1 - openSUSE Leap 15.4 (x86_64): libfreebl3-32bit-3.79.3-150400.3.23.1 libfreebl3-32bit-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-32bit-3.79.3-150400.3.23.1 libsoftokn3-32bit-3.79.3-150400.3.23.1 libsoftokn3-32bit-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-32bit-3.79.3-150400.3.23.1 mozilla-nss-32bit-3.79.3-150400.3.23.1 mozilla-nss-32bit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-certs-32bit-3.79.3-150400.3.23.1 mozilla-nss-certs-32bit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-sysinit-32bit-3.79.3-150400.3.23.1 mozilla-nss-sysinit-32bit-debuginfo-3.79.3-150400.3.23.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libfreebl3-3.79.3-150400.3.23.1 libfreebl3-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-3.79.3-150400.3.23.1 libsoftokn3-3.79.3-150400.3.23.1 libsoftokn3-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-3.79.3-150400.3.23.1 mozilla-nss-3.79.3-150400.3.23.1 mozilla-nss-certs-3.79.3-150400.3.23.1 mozilla-nss-certs-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debugsource-3.79.3-150400.3.23.1 mozilla-nss-devel-3.79.3-150400.3.23.1 mozilla-nss-sysinit-3.79.3-150400.3.23.1 mozilla-nss-sysinit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-tools-3.79.3-150400.3.23.1 mozilla-nss-tools-debuginfo-3.79.3-150400.3.23.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libfreebl3-32bit-3.79.3-150400.3.23.1 libfreebl3-32bit-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-32bit-3.79.3-150400.3.23.1 libsoftokn3-32bit-3.79.3-150400.3.23.1 libsoftokn3-32bit-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-32bit-3.79.3-150400.3.23.1 mozilla-nss-32bit-3.79.3-150400.3.23.1 mozilla-nss-32bit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-certs-32bit-3.79.3-150400.3.23.1 mozilla-nss-certs-32bit-debuginfo-3.79.3-150400.3.23.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): libfreebl3-3.79.3-150400.3.23.1 libfreebl3-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-3.79.3-150400.3.23.1 libsoftokn3-3.79.3-150400.3.23.1 libsoftokn3-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-3.79.3-150400.3.23.1 mozilla-nss-3.79.3-150400.3.23.1 mozilla-nss-certs-3.79.3-150400.3.23.1 mozilla-nss-certs-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debugsource-3.79.3-150400.3.23.1 mozilla-nss-tools-3.79.3-150400.3.23.1 mozilla-nss-tools-debuginfo-3.79.3-150400.3.23.1 References: https://www.suse.com/security/cve/CVE-2022-23491.html https://www.suse.com/security/cve/CVE-2022-3479.html https://bugzilla.suse.com/1204272 https://bugzilla.suse.com/1207038

1 0